The government employee data breach at the Office of Personnel Management, already thought to be one of the most severe losses of government records ever sustained, could be several times worse than originally believed.

But the new damage is not entirely unexpected. “It’s like cancer,” one official familiar with the case told The Washington Post.“Once you start operating on the cancer, you find it has spread to other areas of the body.”

And critics suggest the attackers have had plenty of time to run around inside OPM networks. Wired notes the OPM didn’t have anyone running dedicated IT security until 2013.